mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
P4T12ICK
54 lines
1.7 KiB
YAML
54 lines
1.7 KiB
YAML
name: Circle CI Disable Security Job
|
|
id: 4a2fdd41-c578-4cd4-9ef7-980e352517f2
|
|
version: 1
|
|
date: '2021-09-02'
|
|
author: Patrick Bareiss, Splunk
|
|
type: Anomaly
|
|
datamodel: []
|
|
description: This search looks for disable security job in CircleCI pipeline.
|
|
search: '`circleci` | rename vcs.committer_name as user vcs.subject as commit_message
|
|
vcs.url as url workflows.* as * | stats values(job_name) as job_names by workflow_id
|
|
workflow_name user commit_message url branch | lookup mandatory_job_for_workflow
|
|
workflow_name OUTPUTNEW job_name AS mandatory_job | search mandatory_job=* | eval
|
|
mandatory_job_executed=if(like(job_names, "%".mandatory_job."%"), 1, 0) | where
|
|
mandatory_job_executed=0 | eval phase="build" | rex field=url "(?<repository>[^\/]*\/[^\/]*)$"
|
|
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `circle_ci_disable_security_job_filter`'
|
|
how_to_implement: You must index CircleCI logs.
|
|
known_false_positives: unknown
|
|
references: []
|
|
tags:
|
|
analytic_story:
|
|
- Dev Sec Ops
|
|
asset_type: CircleCI
|
|
cis20:
|
|
- CIS 13
|
|
confidence: 90
|
|
context:
|
|
- Source:Application Log
|
|
dataset:
|
|
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1554/circle_ci_disable_security_job/circle_ci_disable_security_job.json
|
|
impact: 80
|
|
kill_chain_phases:
|
|
- Actions on Objectives
|
|
message: disable security job $mandatory_job$ in workflow $workflow_name$ from user
|
|
$user$
|
|
mitre_attack_id:
|
|
- T1554
|
|
nist:
|
|
- PR.DS
|
|
- PR.AC
|
|
- DE.CM
|
|
observable:
|
|
- name: user
|
|
type: User
|
|
role:
|
|
- Attacker
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _times
|
|
risk_score: 72
|
|
security_domain: network
|